CVE-2026-27802 - Vulnerability Analysis

Overview

Vaultwarden < 1.35.4 contains a privilege escalation caused by bulk permission update to unauthorized collections by Manager, letting attackers escalate privileges, exploit requires Manager role.

Severity & Score

Impact

Attackers with Manager role can escalate privileges by updating permissions on unauthorized collections.

Mitigation

Update to version 1.35.4 or later.

References

• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-r32r-j5jq-3w4m

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 5, 2026

🟠 CVE-2026-27802 - High (8.3) Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. Thi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27802/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner